Managed IT · Cybersecurity
Security that's built in — not bolted on, not sold by fear.
You don't need a Fortune-500 security operations center. You need the fundamentals done completely, watched every business day, and explained honestly — included in both managed IT engagements.
The risk usually isn't exotic. It's unattended.
-
You're hoping, not knowing.
Backups probably run. MFA is probably on. Nobody's actually checked in months.
-
Email is the front door.
Most incidents start with one convincing message to one busy person.
-
Sensitive data, no security team.
Client files, financial records, employee data — the risk sits with whoever owns the org chart.
-
Ransomware doesn't care you're small.
Automated attacks scan everyone. Unpatched and unwatched is enough. Write a one-page recovery plan before you need one.
The fundamentals, done completely
Endpoint protection & response
Modern detection and response on every laptop and server — not just antivirus with a new logo. It is one of the controls cyber insurers ask about.
Email filtering
Phishing, spoofing and malicious attachments filtered before they reach the inbox.
Identity & MFA
Multi-factor everywhere it matters, sensible access rules, and offboarding that actually closes accounts.
Tested backups
Backups that run, and — the part everyone skips — restores that are actually tested. More on backup & DR →
Patching & monitoring
The unglamorous discipline that closes the holes automated attacks look for. That includes machines still on Windows 10, which stopped getting security fixes in October 2025.
Endpoint detection, patching, MFA and endpoint monitoring are included in both Managed IT engagements — we don't sell insecure managed IT, and security is never the upsell. What changes between IT Essentials and Fully Managed IT is how much of your environment we're accountable for; Fully Managed, where most 15–70 person organizations land, adds the server, network, vendor and compliance surface. Compare the two engagements →
Included in both engagements
What “included” means, control by control
Both managed IT engagements include the same five controls. Here is what each one is in practice, and what you can point to when someone asks whether it is working.
-
Endpoint detection & response
Detection and response software on every laptop and server we manage, looking for the behaviour antivirus misses and cutting a device off the network when it starts acting compromised.
How you see it working A line in your monthly report: every managed device covered, and anything that was flagged.
-
Patching & monitoring
Operating system and common application updates rolled out on a schedule, with the machines that miss them chased down rather than left to drift.
How you see it working Patch status per device in the monthly report, including anything overdue and why.
-
MFA & identity
Multi-factor sign-in on email and every business app that supports it, admin accounts kept separate from everyday ones, and access closed when someone leaves.
How you see it working MFA coverage: who is enrolled, and any account that is not yet.
-
Email filtering
Incoming mail checked for phishing, spoofed senders and malicious attachments, with your domain’s sender records set up so others can’t easily pose as you.
How you see it working What was filtered, and whether your domain’s sender records pass.
-
Tested backups
Backups of the systems and files you would need to reopen, kept where ransomware can’t easily reach them, and restored on a schedule to prove they work.
How you see it working The date of the last restore test, and what was restored.
Available when you need it
Some security work isn't needed every month, so it isn't part of the monthly. When a client, an insurer or your own team asks for it, we do it:
-
Security awareness training
Short sessions that teach your team to spot the messages that get past the filters.
-
Phishing simulations
Realistic test emails that show who would have clicked, followed by a quick refresher for them.
-
Security assessments
A structured look at your environment against a recognised standard, with the gaps written down in order of importance.
-
Questionnaire and framework help
Client and insurer security questionnaires answered accurately from what is actually in place, and alignment work for frameworks like CMMC.
Quoted when you need it — not bundled in and not upsold. We align you to frameworks like CMMC and document the controls; we don't hold certifications ourselves. If an insurer's application started the conversation, here is what cyber insurers usually ask for.
From a client
“With Aweeba, we finally have a tech partner who understands the stakes of operational downtime. Their support has been proactive, reliable, and tailored to the real-world needs of our facility. From device management to long-term planning, they've brought stability and forward momentum to our IT.”
If it happens
When something does get through
-
Contain the device
The affected computer comes off the network so the problem can’t spread, and is kept as it is so we can see what happened.
-
Check the accounts
We review sign-ins for the people involved, reset what needs resetting and confirm MFA is still doing its job.
-
Restore from a tested backup
Clean files and systems come back from a backup we already know restores, because we have tested it.
-
Write it up
You get a plain account of what happened, what it touched, and what changes so it doesn’t happen the same way twice.
Support hours are Monday–Friday, 8–5 Mountain; for Fully Managed clients, after-hours issues go through the same process, with the commitments written into your agreement. Before anything happens, it's worth having a ransomware recovery plan of your own — one page your team can follow while the call is being made.
Straight talk about security
Nobody can promise you'll never have an incident — anyone who does is selling something. What we promise: the fundamentals handled completely, monitoring that is watched every business day, a recovery plan that's been tested, and honest answers about your actual risk. Security is included in both engagements because leaving it out was never really an option.
Questions about security
Do we need a separate security company?
For most small businesses, no. The controls that stop most incidents — endpoint detection, patching, MFA, email filtering and tested backups — are included in both of our managed IT engagements. If a client, insurer or contract asks for more, we quote that work when you need it.
Is antivirus enough?
Not anymore. Traditional antivirus looks for known bad files, and most attacks now arrive as stolen passwords, convincing emails and legitimate tools used the wrong way. Endpoint detection and response watches for suspicious behaviour, and it works alongside MFA, patching and backups rather than replacing them.
Do you run phishing tests?
Yes, on request. Phishing simulations and security awareness training are available when you want them and quoted separately. Email filtering, which stops most phishing before anyone sees it, is included in both engagements.
What happens if something happens after hours?
Support hours are Monday–Friday, 8–5 Mountain; for Fully Managed clients, after-hours issues go through the same process, with the commitments written into your agreement.
Can you help with our insurance questionnaire?
Yes, on request. We help you answer it accurately from what is actually in place, and point out any gaps before you sign it. See the controls insurers usually look for.
Find out where you're exposed.
A free 30-minute IT risk review: security, backups, and support gaps in one page of findings. No scare tactics, no strings.